Unit

Private IP Addresses: RFC 1918 Ranges, NAT, and Network Planning

Learn what private IPv4 addresses are, the RFC 1918 ranges, subnet planning, DHCP, default gateways, NAT, PAT, and common troubleshooting steps.

A private IP address is an IPv4 address reserved for use inside an internal network, such as a home, school, business, or data center. Private addresses are not globally routable on the public Internet. They identify devices within a local or private network and commonly work with Network Address Translation (NAT) to provide Internet access.

An IPv4 address is a 32-bit address used to identify a network interface. It is normally written in dotted-decimal notation, such as 192.168.1.25. A public IP address is globally unique and Internet-routable, while a private IP address can be reused by many independent networks.

Why Private IP Addresses Are Used

Homes, schools, and organizations often have many devices but do not need a separate public address for every device. A private addressing scheme lets administrators assign addresses to computers, phones, printers, servers, wireless access points, and management interfaces without consuming large numbers of public IPv4 addresses.

• Private addresses are intended for internal communication.
• The same private range can be used independently by different organizations.
• Routers on the public Internet do not normally forward traffic with RFC 1918 source or destination addresses.
• An edge router or firewall can translate internal addresses to one or more public addresses when traffic leaves the private network.

Private addressing is not, by itself, a security control. A private host can still be attacked by another device on the same network, through a misconfigured router, or through an allowed connection. Firewalls, authentication, segmentation, and appropriate access controls are still required.

RFC 1918 Private IPv4 Ranges

RFC 1918 defines three IPv4 blocks for private networks. CIDR notation expresses a network with an address and a prefix length, such as /24. The prefix identifies the network portion of the address; the remaining bits identify addresses within that network.

The first and last addresses above describe the complete RFC 1918 blocks. When a block is divided into subnets, each individual subnet has its own network and broadcast addresses. For example, in 192.168.1.0/24, 192.168.1.0 is the subnet's network address and 192.168.1.255 is its broadcast address. The usual host range is 192.168.1.1 through 192.168.1.254.

Typical Masks and Deployments

A prefix does not determine whether an address is private by itself. The address must fall inside one of the three RFC 1918 blocks. For example, 10.20.30.0/24 is private, while an arbitrary 11.20.30.0/24 network is not.

Private Addressing on a Local-Area Network

A local-area network (LAN) connects devices in a limited location or logical segment. Private addresses can be assigned to workstations, laptops, phones, printers, application servers, routers, and switches that have management interfaces. A Layer 2 switch forwards frames using MAC addresses, but a switch with a management interface also needs an IP address for administration.

The subnet mask identifies which bits belong to the network and which bits belong to hosts. Two hosts can communicate directly at Layer 3 when they are in the same IP subnet and are not separated by a policy such as VLAN isolation. Their addresses and masks must agree about the local network.

Network, Host, Broadcast, and Gateway Addresses

• Network address: identifies the subnet itself and is normally not assigned to a host.
• Host address: an address assigned to an interface within the subnet.
• Broadcast address: reaches all hosts on that IPv4 subnet and is normally not assigned to a host.
• Default gateway: the local router address a host uses when the destination is outside its own subnet.

For 10.20.30.0/24, the network address is 10.20.30.0, the conventional host range is 10.20.30.1 through 10.20.30.254, and the broadcast address is 10.20.30.255. An organization might assign 10.20.30.1 to the router and use the remaining host addresses for devices.

For a home example, the router might use 192.168.1.1/24 as its LAN gateway and provide DHCP leases from 192.168.1.100 through 192.168.1.200.

How NAT and PAT Provide Internet Access

Network Address Translation (NAT) changes an address as traffic passes between networks. In a common design, internal devices use private source addresses and the edge router or firewall translates those sources to a public address assigned by an Internet service provider.

1. A private host, such as 192.168.1.100, sends traffic to its default gateway.
2. The edge router receives the packet and records a translation for the connection.
3. The router replaces the private source address with its public WAN address.
4. The Internet server replies to the public address.
5. The router consults its translation table and sends the response back to the original private host.

Port Address Translation (PAT) is a common form of NAT used by home and small-office routers. PAT also tracks TCP or UDP port numbers, allowing many internal devices to share one public IPv4 address while maintaining separate sessions.

Outbound connections work because the router creates a translation entry when an internal device starts the session. Unsolicited inbound connections generally do not have a matching entry, so they are discarded or denied. To publish an internal service, an administrator usually creates an explicit port-forwarding or destination-NAT rule, then permits the traffic through the firewall and secures the service.

Choosing and Planning Private Address Space

Choose a range that fits the current network and leaves room for growth. 192.168.0.0/16 is convenient for small environments, while 10.0.0.0/8 provides a large planning space for many sites and departments. The 172.16.0.0/12 block provides a middle-sized alternative.

• Use subnetting to divide a larger private block into departments, locations, VLANs, server networks, guest networks, or device categories.
• Reserve addresses for gateways, infrastructure, printers, servers, monitoring, and other devices that need predictable addresses.
• Define DHCP scopes that do not conflict with static addresses or reservations.
• Record every subnet, prefix or mask, gateway, DHCP scope, DNS setting, VLAN, and reserved address.
• Plan for VPNs, cloud connections, acquisitions, and future sites before assigning ranges.

Address overlap occurs when connected networks use identical or conflicting ranges. For example, if two offices both use 192.168.1.0/24, a site-to-site VPN cannot reliably distinguish a local destination from a remote destination. The preferred solution is to renumber one site with a non-overlapping subnet. Translation can sometimes be used as a migration technique, but it adds complexity.

An organization might divide 10.0.0.0/8 into larger regional blocks and then subdivide those blocks into /24 VLANs. Routers or firewalls can route between the VLANs, while access-control rules determine which departments are allowed to communicate.

Static, DHCP, and Reserved Address Assignment

Static Addressing

A static IP address is manually configured on a device. Static addressing is useful for infrastructure that must remain predictable, such as routers, switches, firewalls, servers, printers, and monitoring targets. Manual configuration requires careful documentation and creates a risk of duplicate addresses if the plan is not maintained.

DHCP Assignment

DHCP automatically supplies a client with an IP address, subnet mask, default gateway, DNS servers, and lease duration. DHCP is appropriate for user devices and other clients whose addresses do not need to remain fixed.

DHCP Reservations

A DHCP reservation associates a device identity, commonly its MAC address, with a particular IP address. The device still receives its settings from DHCP, but it normally receives the same address each time. Reservations are often a good choice for printers, cameras, access points, and servers when centralized management is preferred.

subnet:              192.168.10.0/24
gateway:             192.168.10.1
DHCP pool:           192.168.10.100-192.168.10.199
static/reserved:     192.168.10.2-192.168.10.99
broadcast:           192.168.10.255

Commands for Inspecting Private IPv4 Configuration

Use these commands to determine whether a host has a private address and whether its gateway is configured correctly.

• Windows: ipconfig /all displays the IPv4 address, subnet mask, default gateway, DHCP server, and adapter details.
• Linux: ip addr show displays addresses assigned to interfaces.
• Linux: ip route displays routes, including the default route and its gateway.
• Windows, Linux, and macOS: ping <gateway-address> tests reachability to the local router.
• Windows: tracert <public-hostname-or-address> traces an external route and often shows the private gateway as the first hop.
• Linux and macOS: traceroute <public-hostname-or-address> traces the route toward an external destination.

Private Addresses and Other Special-Use IPv4 Addresses

Not every non-publicly-routable IPv4 address is an RFC 1918 private address. These ranges have different purposes and should not be treated as interchangeable.

Troubleshooting Private Addressing

A Device Has a 169.254.x.x Address

This usually means the device failed to obtain the expected DHCP lease. Check the physical or wireless connection, confirm the correct VLAN or wireless SSID, renew the lease, and verify that the DHCP server and scope have available addresses.

Two Devices on the Same LAN Cannot Communicate

Compare their IP addresses and subnet masks. Also check for duplicate addresses, host firewall rules, and VLAN isolation. Devices that appear to be on the same physical LAN may be in different logical VLANs and require routing or a policy change.

A Device Reaches Local Resources but Not the Internet

First ping the default gateway. Then test a known public IP address separately from a hostname. If the gateway responds but external traffic fails, inspect the edge router's WAN status, NAT or PAT configuration, firewall policy, and DNS settings.

A VPN Connects but Remote Resources Are Unreachable

Compare local and remote subnet ranges for overlap, inspect route tables, verify VPN traffic selectors, and review firewall rules. Non-overlapping address plans are the most reliable solution.

Key Points to Remember

• The RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• Private addresses can be reused by independent networks and are not globally routed across the public Internet.
• A subnet mask or CIDR prefix separates the network portion from the host portion.
• The default gateway forwards traffic destined outside the local subnet.
• NAT and especially PAT commonly let many private hosts share one public IPv4 address.
• Inbound access to a private service normally requires an explicit forwarding or translation rule and suitable firewall policy.
• Loopback, link-local, unspecified, limited broadcast, and carrier-grade NAT addresses have different meanings from RFC 1918 private addresses.
• Documenting subnets and avoiding overlap are essential when connecting sites with routing or VPNs.

For related study, review how to create subnets, IP routing, what a router does, and computer network fundamentals.